Control and power supply network for vehicle braking system

ABSTRACT

An electrically controlled braking system includes a first control unit and a second control unit in electrical communication via a communication link and a human machine-interface manipulatable by a vehicle operator. The human-machine interface includes a first sensor and a second sensor, the first sensor providing an input signal to the first control unit, and the second sensor providing an input signal to the second control unit. The first control unit and the second control unit compare the input signal received from the first sensor with the input signal received from the second sensor, and generate control signals at least in part based upon the input signal received from the first sensor, the input signal received from the second sensor, and the comparison of the input signal received from the first sensor with the input signal received from the second sensor.

RELATED APPLICATIONS

This patent application is a continuation-in-part of currently pendingU.S. patent application Ser. No. 10/673,782 filed Sep. 29, 2003, is acontinuation-in-part of currently pending U.S. patent application Ser.No. 10/674,199 filed Sep. 29, 2003, and claims the benefit of, underTitle 35, United States Code, Section 119(e), U.S. Provisional PatentApplication No. 60/570,584, filed May 13, 2004.

FIELD OF THE INVENTION

The present invention relates generally to an electrically controlledand/or electrically actuated braking system which is intended for usewith wheeled vehicles, and more particularly to a control and powersupply network for such a braking system which incorporates enhancedsafety features.

BACKGROUND OF THE INVENTION

Traditional braking systems for motor vehicles include conventionalhydraulic or pneumatic brakes associated with two or more wheels of thevehicle. Such conventional brakes are actuated by pressurized fluid orcompressed air. When actuated, the brakes exert a force on a disk ordrum which spins in conjunction with the wheel of the vehicle in orderto create frictional forces which resist rotation of the wheel.Traditionally, control signals have been transmitted to each of thebrake system's actuators mechanically, or by a hydraulic or pneumaticcontrol circuit. However, it has more recently been proposed to employ acentralized control unit to generate electronic control signals and touse such electronic control signals to control actuation of a vehicle'sbrakes. This type of electronic control scheme has become even moreprevalent in view of modern brake systems which now often include notonly conventional hydraulic or pneumatic brake actuator functionality,but also supplemental electronic functions such as antilock protection(ABS), electronic dynamic stability control (ESP) and/or electronicbraking force distribution (EBV) between the front and rear axles, aswell as blending of brake effort distribution between the conventionalservice brakes and auxiliary brakes, such as retarders and enginebrakes.

U.S. Pat. No. 6,354,671 discloses a brake system in which electronicsignals are used to at least partially control actuation of a vehicle'sbrakes. However, as recognized in the patent, brake system failure dueto failure of the electronic control unit (for example, due to a failurein the electrical power supply) is a significant risk. As such, systemredundancy is provided in the form of a back-up pneumatic controlcircuit. Should the electronic control unit malfunction due to failureof the electrical power supply or for some other reason, the brakingsystem is controlled by the back-up pneumatic control circuit in muchthe same way as traditional brake systems operate. However, such asystem suffers from a number of disadvantages. Providing a back-uppneumatic control circuit greatly complicates the braking system andincreases the costs thereof. Moreover, when operating in the back-upmode, the advanced functionality of the electronic control system islost. As such, providing a pneumatic back-up system defeats many of theadvantages of providing an electronic control circuit in the firstplace.

U.S. Pat. No. 6,209,966 obviates some of the problems associated withproviding a back-up pneumatic control circuit by employing twoelectronic control units, which operate independently of each other, andwhich provide control signals to a brake cylinder assigned to a wheeland a braking pressure modulator valve which is fluid-connected to thebrake cylinder. The braking pressure modulator has a first electricactuating element, which can be activated by a first of the two controlunits, and a second electric actuating element which acts in the samedirection when activated as the first electric actuating element. Thesecond electric actuating element can be activated by the secondelectronic control unit at the same time as the first electric actuatingelement is being activated by the first electronic control unit. Thus,system redundancy is provided by providing two separate electroniccontrol units, each of which controls one of two separate electricactuating elements associated with each wheel.

While U.S. Pat. No. 6,209,966 obviates some of the problems associatedwith providing a back-up pneumatic control circuit, it suffers fromdisadvantages of its own. The braking system disclosed in the '966patent would require two separate electronic actuating elementsassociated with each wheel. This requirement, however, needlesslycomplicates and increases the cost of the system. This is true becausecontrol problems, when they arise, are generally caused by a malfunctionin the control unit, the control network by which control signals aretransmitted to the actuating elements and/or the power supply network ornetworks, not by failure of the actuating elements themselves. As such,providing two actuating elements for each wheel would not significantlyenhance safety of the braking system. Moreover, because both electroniccontrol networks (i.e., the control networks associated with eachelectronic control unit) and presumably the electrical power supplynetwork or networks are directly connected to actuating elements at eachwheel, it is possible for an external catastrophic event, such as a tireexplosion, in the vicinity of one of the wheels to cut the control andpower supply network cabling and/or cause a short-circuit in bothcontrol networks as well as the power supply network or networks,thereby causing the entire brake system to fail.

It has been suggested to create a redundant electronic control systemwhere two separate control networks are employed. Such a system 100,shown in FIG. 1, employs one or more central control units 102 providedto control two or more brake assemblies 104, 106, 108, 110, 112, 114,each having a brake actuator 116 incorporating an electronic controlunit 118. Central control unit or units 102 is or are in electricalcommunication with the electronic control unit 118 of each of brakeassemblies 104, 106, 108, 110, 112, 114 via at least two electroniccontrol networks 120, 122. As seen in FIG. 1, all of electronic controlunits 118 of all brake assemblies 104, 106, 108, 110, 112, 114 areconnected to each electronic control network 120, 122. By providing suchan arrangement, should one electronic control network fail, the otherelectronic control network would theoretically maintain control of allbrake assemblies.

However, this arrangement suffers from disadvantages similar to thosesuffered by U.S. Pat. No. 6,209,966 discussed above. More specifically,because both electronic control networks 120, 122 are directlyelectrically connected to electronic control units 118 of all brakeassemblies 104, 106, 108, 110, 112, 114, it is possible for an externalcatastrophic event, such as a tire explosion, in the vicinity of one ofthe brake assemblies to cut the network cabling and/or cause ashort-circuit in both control networks 120, 122, thereby causing theentire brake system to fail.

It has also been suggested to create a redundant power supply systemwhere two separate power supply networks are employed. Such a system200, shown in FIG. 2, employs one or more power supplies 202 provided tosupply power to two or more brake assemblies 204, 206, 208, 210, 212,214, each having a brake actuator 216 incorporating an electroniccontrol unit 218. Power supply or supplies 202 is or are in electricalcommunication with the electronic control unit 218 of each of brakeassemblies 204, 206, 208, 210, 212, 214 via at least two power supplynetworks 220, 222. As seen in FIG. 2, all of electronic control units218 of all brake assemblies 204, 206, 208, 210, 212, 214 are connectedto each power supply network 220, 222. By providing such an arrangement,should one power supply network fail, the other power supply networkwould theoretically supply power to all brake assemblies.

However, this arrangement also suffers from disadvantages similar tothose suffered by U.S. Pat. No. 6,209,966 discussed above. Morespecifically, because both power supply networks 220, 222 are directlyelectrically connected to electronic control units 218 of all brakeassemblies 204, 206, 208, 210, 212, 214, it is possible for an externalcatastrophic event, such as a tire explosion, in the vicinity of one ofthe brake assemblies to cut the network cabling and/or cause ashort-circuit in both power supply networks 220, 222, thereby causingthe entire brake system to fail.

A further disadvantage of all known systems is that none take intoaccount the possibility of errors occurring between an input deviceactuated by a user and the control unit(s), which typically converts theinput signals received from an input device into brake control signalsto be used by the brake actuators to control the brakes. Rather, knownprior art systems which do provide some type of “error checking” checkonly for transmission errors within the communications networks betweenthe control unit(s) and the brake actuators. There is no provision forthe checking of errors between input devices and the control unit(s).

What is desired, therefore, is an electrically controlled braking systemwhich is intended for use with wheeled vehicles, which incorporatesenhanced safety features, which employs system redundancy in case ofpartial system failure, which is relatively uncomplicated and lesscostly as compared to known systems, which is not prone to completesystem failure in the case of an external catastrophic event, and whichprovides for the checking of errors between input devices and thecontrol unit(s) which control actuation of the brakes.

SUMMARY OF THE INVENTION

Accordingly, it is an object of the present invention to provide anelectrically controlled braking system which is intended for use withwheeled vehicles.

Another object of the present invention is to provide an electricallycontrolled braking system having the above characteristics and whichincorporates enhanced safety features.

A further object of the present invention is to provide an electricallycontrolled braking system having the above characteristics and whichemploys system redundancy in case of partial system failure.

Still another object of the present invention is to provide anelectrically controlled braking system having the above characteristicsand which is relatively uncomplicated and less costly as compared toknown systems.

Yet a further object of the present invention is to provide anelectrically controlled braking system having the above characteristicsand which is not prone to complete system failure in the case of anexternal catastrophic event.

Still a further object of the present invention is to provide anelectrically controlled braking system having the above characteristicsand which provides for the checking of errors between input devices andthe control unit(s) which control actuation of the brakes.

These and other objects of the present invention are achieved accordingto one embodiment by provision of an electrically controlled brakingsystem which includes a first control unit and a second control unit inelectrical communication via a communication link and a humanmachine-interface manipulatable by a vehicle operator. The human-machineinterface includes a first sensor and a second sensor, the first sensorproviding an input signal to the first control unit, and the secondsensor providing an input signal to the second control unit. The firstcontrol unit and the second control unit compare the input signalreceived from the first sensor with the input signal received from thesecond sensor, and generate control signals at least in part based uponthe input signal received from the first sensor, the input signalreceived from the second sensor, and the comparison of the input signalreceived from the first sensor with the input signal received from thesecond sensor.

In some embodiments, the first control unit and the second control unitfurther determine whether the input signal received from the firstsensor and the input signal received from the second sensor are valid.In certain of these embodiments, the determination as to whether theinput signal received from the first sensor and the input signalreceived from the second sensor are valid is based at least in part upona determination as to whether the input signal received from the firstsensor and the input signal received from the second sensor have valuesfalling within an expected range. In certain embodiments, the systemfurther includes an error condition indicator, and the error conditionindicator is activated if at least one of the input signal received fromthe first sensor and the input signal received from the second sensor isinvalid. In certain embodiments, the first control unit and the secondcontrol unit generate control signals indicative of a demand for parkingbrake application if both of the input signal received from the firstsensor and the input signal received from the second sensor are invalid.

In some embodiments, the comparison of the input signal received fromthe first sensor with the input signal received from the second sensoris based at least in part upon a determination of whether a value of theinput signal received from the first sensor differs from a value of theinput signal received from the second sensor by more than an acceptablevariance. In certain of these embodiments, the comparison of the inputsignal received from the first sensor with the input signal receivedfrom the second sensor is further based at least in part upon adetermination of whether a value of the input signal received from thesecond sensor differs from a value of the input signal received from thefirst sensor by more than an acceptable variance. In some embodiments,the human machine-interface comprises at least one of a pedal, a switch,a joystick, a lever, a button and a knob.

In some embodiments, the system further includes a first brake componentresponsive to the control signals generated by the first control unitand the second control unit, a second brake component responsive to thecontrol signals generated by the first control unit and the secondcontrol unit, a first control network electrically connecting the firstcontrol unit and the first brake component, the first control networkadapted to transmit the control signals from the first control unit tothe first brake component, and a second control network electricallyconnecting the second control unit and the second brake component, thesecond control network adapted to transmit the control signals from thesecond control unit to the second brake component. In certain of theseembodiments, the system further includes an auxiliary control linkelectrically connecting the first brake component and the second brakecomponent, the auxiliary control link adapted to transmit the controlsignals between the first brake component and the second brake componentwhen a failure occurs in one of the first control network or the secondcontrol network.

In some embodiments, the system further includes at least one powersupply, the at least one power supply supplying electrical power, afirst brake component responsive to the control signals generated by thefirst control unit and the second control unit and at least partiallyoperated by electrical power, a second brake component responsive to thecontrol signals generated by the first control unit and the secondcontrol unit and at least partially operated by electrical power, afirst power supply network electrically connecting the at least onepower supply and the first brake component, the first power supplynetwork adapted to transmit the electrical power from the at least onepower supply to the first brake component, and a second power supplynetwork electrically connecting the at least one power supply and thesecond brake component, the second power supply network adapted totransmit the electrical power from the at least one power supply to thesecond brake component. In certain embodiments, the system furtherincludes an auxiliary power supply link activatable to electricallyconnect the first brake component and the second brake component when afailure occurs in one of the first power supply network or the secondpower supply network, the auxiliary power supply link adapted totransmit the electrical power between the first brake component and thesecond brake component when the failure occurs.

In accordance with another embodiment of the present invention, anelectrically controlled braking system includes at least one controlunit, the at least one control unit generating control signals, at leastone power supply, the at least one power supply supplying electricalpower, a first brake component responsive to the control signalsgenerated by the at least one control unit and at least partiallyoperated by electrical power, a second brake component responsive to thecontrol signals generated by the at least one control unit and at leastpartially operated by electrical power, a first control networkelectrically connecting the at least one control unit and the firstbrake component, the first control network adapted to transmit thecontrol signals from the at least one control unit to the first brakecomponent, a second control network electrically connecting the at leastone control unit and the second brake component, the second controlnetwork adapted to transmit the control signals from the at least onecontrol unit to the second brake component, an auxiliary control linkelectrically connecting the first brake component and the second brakecomponent, the auxiliary control link adapted to transmit the controlsignals between the first brake component and the second brake componentwhen a failure occurs in one of the first control network or the secondcontrol network, a first power supply network electrically connectingthe at least one power supply and the first brake component, the firstpower supply network adapted to transmit the electrical power from theat least one power supply to the first brake component, a second powersupply network electrically connecting the at least one power supply andthe second brake component, the second power supply network adapted totransmit the electrical power from the at least one power supply to thesecond brake component, and an auxiliary power supply link activatableto electrically connect the first brake component and the second brakecomponent when a failure occurs in one of the first power supply networkor the second power supply network, the auxiliary power supply linkadapted to transmit the electrical power between the first brakecomponent and the second brake component when the failure occurs.

In some embodiments, the at least one control unit comprises a firstcontrol unit and a second control unit, the first control unit and thesecond control unit being in electrical communication via acommunication link, the system further includes a humanmachine-interface manipulatable by a vehicle operator, the human-machineinterface comprising a first sensor and a second sensor, the firstsensor providing an input signal to the first control unit, and thesecond sensor providing an input signal to the second control unit, andthe first control unit and the second control unit compare the inputsignal received from the first sensor with the input signal receivedfrom the second sensor, and generate control signals at least in partbased upon the input signal received from the first sensor, the inputsignal received from the second sensor, and the comparison of the inputsignal received from the first sensor with the input signal receivedfrom the second sensor.

In certain of these embodiments, the first control unit and the secondcontrol unit further determine whether the input signal received fromthe first sensor and the input signal received from the second sensorare valid. In certain of these embodiments, the determination as towhether the input signal received from the first sensor and the inputsignal received from the second sensor are valid is based at least inpart upon a determination as to whether the input signal received fromthe first sensor and the input signal received from the second sensorhave values falling within an expected range. In certain embodiments,the system further includes an error condition indicator, and the errorcondition indicator is activated if at least one of the input signalreceived from the first sensor and the input signal received from thesecond sensor is invalid. In certain embodiments, the first control unitand the second control unit generate control signals indicative of ademand for parking brake application if both of the input signalreceived from the first sensor and the input signal received from thesecond sensor are invalid.

In some embodiments, the comparison of the input signal received fromthe first sensor with the input signal received from the second sensoris based at least in part upon a determination of whether a value of theinput signal received from the first sensor differs from a value of theinput signal received from the second sensor by more than an acceptablevariance. In certain of these embodiments, the comparison of the inputsignal received from the first sensor with the input signal receivedfrom the second sensor is further based at least in part upon adetermination of whether a value of the input signal received from thesecond sensor differs from a value of the input signal received from thefirst sensor by more than an acceptable variance. In some embodiments,the human machine-interface comprises at least one of a pedal, a switch,a joystick, a lever, a button and a knob.

In accordance with another aspect of the present invention, a method ofcontrolling a braking system includes the steps of: providing a firstcontrol unit and a second control unit in electrical communication withone another via a communication link; manipulating a humanmachine-interface having a first sensor and a second sensor; providingan input signal from the first sensor to the first control unit;providing an input signal from the second sensor to the second controlunit; comparing the input signal received from the first sensor with theinput signal received from the second sensor; and generating controlsignals at least in part based upon the input signal received from thefirst sensor, the input signal received from the second sensor, and thecomparison of the input signal received from the first sensor with theinput signal received from the second sensor.

In some embodiments, the method further includes the step of determiningwhether the input signal received from the first sensor and the inputsignal received from the second sensor are valid. In certain of theseembodiments, the step of determining whether the input signal receivedfrom the first sensor and the input signal received from the secondsensor are valid is based at least in part upon a determination as towhether the input signal received from the first sensor and the inputsignal received from the second sensor have values falling within anexpected range. In certain embodiments, the method further includes thestep of activating an error condition indicator if at least one of theinput signal received from the first sensor and the input signalreceived from the second sensor is invalid. In certain of theseembodiments, the method further includes the step of generating controlsignals indicative of a demand for parking brake application if both ofthe input signal received from the first sensor and the input signalreceived from the second sensor are invalid.

In some embodiments, the step of comparing the input signal receivedfrom the first sensor with the input signal received from the secondsensor is based at least in part upon a determination of whether a valueof the input signal received from the first sensor differs from a valueof the input signal received from the second sensor by more than anacceptable variance. In certain of these embodiments, the step ofcomparing the input signal received from the first sensor with the inputsignal received from the second sensor is further based at least in partupon a determination of whether a value of the input signal receivedfrom the second sensor differs from a value of the input signal receivedfrom the first sensor by more than an acceptable variance. In certainembodiments, the human machine-interface comprises at least one of apedal, a switch, a joystick, a lever, a button and a knob.

In some embodiments, the method further includes the steps of: providinga first brake component responsive to the control signals generated bythe first control unit and the second control unit; providing a secondbrake component responsive to the control signals generated by the firstcontrol unit and the second control unit; electrically connecting thefirst control unit and the first brake component via a first controlnetwork, the first control network adapted to transmit the controlsignals from the first control unit to the first brake component; andelectrically connecting the second control unit and the second brakecomponent via a second control network, the second control networkadapted to transmit the control signals from the second control unit tothe second brake component. In certain of these embodiments, the methodfurther includes the step of electrically connecting the first brakecomponent and the second brake component via an auxiliary control link,the auxiliary control link adapted to transmit the control signalsbetween the first brake component and the second brake component when afailure occurs in one of the first control network or the second controlnetwork.

In some embodiments, the method further includes the steps of: supplyingelectrical power with at least one power supply; providing a first brakecomponent responsive to the control signals generated by the firstcontrol unit and the second control unit and at least partially operatedby electrical power; providing a second brake component responsive tothe control signals generated by the first control unit and the secondcontrol unit and at least partially operated by electrical power;electrically connecting the at least one power supply and the firstbrake component via a first power supply network, the first power supplynetwork adapted to transmit the electrical power from the at least onepower supply to the first brake component; and electrically connectingthe at least one power supply and the second brake component via asecond power supply network, the second power supply network adapted totransmit the electrical power from the at least one power supply to thesecond brake component. In certain of these embodiments, the methodfurther includes the step of activating an auxiliary power supply linkto electrically connect the first brake component and the second brakecomponent when a failure occurs in one of the first power supply networkor the second power supply network, the auxiliary power supply linkadapted to transmit the electrical power between the first brakecomponent and the second brake component when the failure occurs.

The invention and its particular features and advantages will becomemore apparent from the following detailed description considered withreference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic view of an electrically controlled braking systemwhich incorporates redundant control networks in accordance with a knownprior art design;

FIG. 2 is a schematic view of an electrically controlled braking systemwhich incorporates redundant power supply networks in accordance with aknown prior art design;

FIG. 3 is a schematic view of an electrically controlled braking systemwhich incorporates redundant control networks and redundant power supplynetworks, along with error checking, in accordance with the presentinvention; and,

FIG. 4 is a flow chart illustrating an example of an error checkingroutine employed by the electrically controlled braking system of FIG.3.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS OF THE INVENTION

Referring to FIG. 3, electrically controlled and/or actuated brakingsystem 10 in accordance with the present invention is shown. Brakingsystem 10 includes at least two control units 12, 12′ which generatecontrol signals, and at least one power supply 13 which generates and/orstores electrical power. Braking system 10 also includes a plurality ofbrake components 14, 16, 18, 20, 22, 24. While six brake components 14,16, 18, 20, 22, 24 are shown in FIG. 3, it should be understood thatbraking system 10 may include a greater or lesser number of brakecomponents. It is desirable, although not strictly necessary, that aneven number of brake components are provided, and that the brakecomponents are treated as pairs. For example, the brake componentsassociated with the pair of wheels on each axle may be treated as apair. In FIG. 3, first brake component 14 is paired with second brakecomponent 16, third brake component 18 is paired with fourth brakecomponent 20, and fifth brake component 22 is paired with sixth brakecomponent 24.

Each of brake components 14, 16, 18, 20, 22, 24 is responsive to thecontrol signals generated by control units 12, 12′, and each operates onelectrical power generated and/or stored by power supply or supplies 13.More particularly, each of brake components 14, 16, 18, 20, 22, 24includes a brake actuator 26 incorporating an electronic control unit 28which electronic control unit 28 causes brake actuator 26 to operate inresponse to the control signals. Electronic control units 28 aresupplied electrical power by power supply or supplies 12. Brakeactuators 26 may comprise electromechanical brake actuators which arealso supplied electrical power by power supply or supplies 13.Alternately, brake actuators 26 may be actuated by hydraulic power,pneumatic power, combinations of these, and/or by any other appropriatenon-electrical power, in which case, it is not necessary to supplyelectrical power to brake actuators 26. As such electronicallycontrollable and/or electrically actuatable brake components are knownin the art, a detailed discussion of the operation thereof is notpresented herein.

Braking system 10 includes at least two control networks fortransmitting control signals from control units 12, 12′ to each of brakecomponents 14, 16, 18, 20, 22, 24, with some of brake components 14, 16,18, 20, 22, 24 being electrically connected to control units 12, 12′ viaone control network and others of brake components 14, 16, 18, 20, 22,24 being electrically connected to control units 12, 12′ via another orother control network(s). Preferably, each one of each pair of brakecomponents is connected to a different control network.

In braking system 10 shown in FIG. 3, two control networks 30, 32 areprovided. First control network 30 electrically connects control unit 12with first brake component 14, third brake component 18 and fifth brakecomponent 22 (i.e., one of each pair of brake components). First controlnetwork 30 is adapted to transmit the control signals from control unit12 to first brake component 14, third brake component 18 and fifth brakecomponent 22. Second control network 32 electrically connects controlunit 12′ with second brake component 16, fourth brake component 20 andsixth brake component 24 (i.e., the other one of each pair of brakecomponents not electrically connected to first control network 30).Second control network 32 is adapted to transmit the control signalsfrom control unit 12′ to second brake component 16, fourth brakecomponent 20 and sixth brake component 24.

It is desirable that no brake component is directly electricallyconnected to both of first control network 30 and second control network32. This is true so as to reduce the likelihood that an externalcatastrophic event, such as a tire explosion, in the vicinity of one ofthe brake components cuts the network cabling and/or causes ashort-circuit in both control networks 30, 32, thereby causing theentire brake system 10 to fail. For example, an external catastrophicevent occurring in the vicinity of first brake component 14 may causedamage to first control network 30, thereby causing first controlnetwork 30 to be shorted and fail. However, because second controlnetwork 32 is not directly electrically connected to first brakecomponent 14, such an external catastrophic event likely would not causedamage to second control network 32, and second control network 32 wouldstill function.

Brake system 10 also includes auxiliary control links between each ofthe pairs of brake components, which auxiliary control linkselectrically connect the pairs of brake components when a failure occursin one of the control networks 30, 32. The auxiliary control links areadapted to transmit the control signals between each of the brakecomponents forming each pair of brake components when such a failureoccurs. In the embodiment shown in FIG. 3, three such auxiliary controllinks 34, 36, 38 are shown. First auxiliary control link 34 electricallyconnects first brake component 14 and second brake component 16, secondauxiliary control link 36 electrically connects third brake component 18and fourth brake component 20, and third auxiliary control link 38electrically connects fifth brake component 22 and sixth brake component24.

It should be recognized that for system 10 to properly function, controlsignals for all brake components 14, 16, 18, 20, 22, 24 should betransmitted over both control networks 30, 32, not just the controlsignals for the brake components directly connected to each individualcontrol network 30, 32. For example, although first brake component 14is not directly connected to second control network 32, the controlsignals for first brake component 14 should be transmitted over secondcontrol network 32, so that in the event of a failure of first controlnetwork 30 (to which first brake component 14 is attached), controlsignals may be transmitted to first brake component 14 through secondcontrol network 32 and second brake component 16 via first auxiliarycontrol link 34.

Thus, as discussed in the above example, suppose that an externalcatastrophic event occurs in the vicinity of first brake component 14which causes damage to first control network 30, thereby causing firstcontrol network 30 to be shorted and/or fail. Because second controlnetwork 32 is not directly electrically connected to first brakecomponent 14, such an external catastrophic event likely would not causedamage to second control network 32, and second control network 32 wouldstill function. Since first brake component 14 would no longer bereceiving control signals through first control network 30, firstauxiliary control link 34 would attempt to supply control signals tofirst brake component 14 from second brake component 16. Of course, dueto the hypothetical external catastrophic event, first brake component14 may be damaged or destroyed and not function properly, and/or firstauxiliary control link 34 may be damaged. Thus, first brake component 14may not be operational. However, third brake component 18 and fifthbrake component 22 are likely not damaged—they are simply no longerreceiving control signals through the failed first control network 30.As such, control signals supplied to third brake component 18 and fifthbrake component 22 from fourth brake component 20 and sixth brakecomponent 24 through second auxiliary control link 36 and thirdauxiliary control link 38 respectively could be used to control thirdbrake component 18 and fifth brake component 22.

Thus, system redundancy is provided, while at the same time isolation ofthe control networks 30, 32 from one another is maintained by providingconnection between brake components on different control networks 30, 32by way of a buffer (i.e., auxiliary control links 34, 36, 38). Thus, itis extremely unlikely that both control networks 30, 32 will fail. Atthe same time, if one of them does fail, control of at least some of thebrake components on the failed control network can still be maintained.

In addition to controlling standard braking operations, control units12, 12′ may control various additional braking functions, such as wheelslip control, e.g., antilock brake systems (ABS), and electronic brakingforce distribution (EBV) systems, as well as other vehicle systems, suchas vehicle suspension and dynamic stability systems. In otheralternatives the brake electronics (i.e., electronic control unit 28) ofeach of brake components 14, 16, 18, 20, 22, 24 can also handle thewheel anti lock function (e.g., ABS). A benefit of such architecture isthat the brake can react quicker upon a detected wheel lock. If thewheel slip control (e.g., ABS) is handled by control units 12, 12′ thetime delay in the communication networks 30, 32 and the computing timein the control units 12, 12′ are introduced as delays in the controlchain (as is the case with most systems today). Instead of employingthis approach, the wheel speed sensor may be connected directly to thebrake electronics (i.e., electronic control unit 28). The vehiclereference speed may be calculated in the control units 12, 12′ and sentback to the brake electronics (i.e., electronic control unit 28), sincethe vehicle speed is changing slower than the wheel speed. The wheelspeed and the vehicle reference speed may then be used by brakeelectronics (i.e., electronic control unit 28) to control braking ofeach wheel, thereby providing a very rapid response. System 10 may alsobe employed to control non-conventional systems, such as regenerativebraking for hybrid vehicles and integrated starter-generator systems(ISG).

Braking system 10 also includes at least two power supply networks fortransmitting electrical power from power supply or supplies 13 to eachof brake components 14, 16, 18, 20, 22, 24, with some of brakecomponents 14, 16, 18, 20, 22, 24 being electrically connected to powersupply or supplies 13 via one power supply network and others of brakecomponents 14, 16, 18, 20, 22, 24 being electrically connected to powersupply or supplies 13 via another or other power supply network(s).Preferably, each one of each pair of brake components is connected to adifferent power supply network.

In braking system 10 shown in FIG. 3, two power supply networks 40, 42are provided. First power supply network 40 electrically connects powersupply or supplies 13 with first brake component 14, third brakecomponent 18 and fifth brake component 22 (i.e., one of each pair ofbrake components). First power supply network 40 is adapted to transmitelectrical power from power supply or supplies 13 to first brakecomponent 14, third brake component 18 and fifth brake component 22.Second power supply network 42 electrically connects power supply orsupplies 13 with second brake component 16, fourth brake component 20and sixth brake component 24 (i.e., the other one of each pair of brakecomponents not electrically connected to first power supply network 40).Second power supply network 42 is adapted to transmit electrical powerfrom power supply or supplies 13 to second brake component 16, fourthbrake component 20 and sixth brake component 24.

It is desirable that no brake component is directly electricallyconnected to both of first power supply network 40 and second powersupply network 42. This is true so as to reduce the likelihood that anexternal catastrophic event, such as a tire explosion, in the vicinityof one of the brake components cuts the network cabling and/or causes ashort-circuit in both power supply networks 40, 42, thereby causing theentire brake system 10 to fail. For example, an external catastrophicevent occurring in the vicinity of first brake component 14 may causedamage to first power supply network 40, thereby causing first powersupply network 40 to be shorted and fail. However, because second powersupply network 42 is not directly electrically connected to first brakecomponent 14, such an external catastrophic event likely would not causedamage to second power supply network 42, and second power supplynetwork 42 would still function.

Brake system 10 also includes auxiliary power supply links between eachof the pairs of brake components, which auxiliary power supply links areactivatable to electrically connect the pairs of brake components when afailure occurs in one of the power supply networks 40, 42, as describedin more detail below. The auxiliary power supply links are adapted totransmit electrical power between each of the brake components formingeach pair of brake components when such a failure occurs. In theembodiment shown in FIG. 3, three such auxiliary power supply links 44,46, 48 are shown. First auxiliary power supply link 44 electricallyconnects first brake component 14 and second brake component 16, secondauxiliary power supply link 46 electrically connects third brakecomponent 18 and fourth brake component 20, and third auxiliary powersupply link 48 electrically connects fifth brake component 22 and sixthbrake component 24.

It should be recognized that for system 10 to properly function, enoughelectrical power for all brake components 14, 16, 18, 20, 22, 24 may betransmitted over both power supply networks 40, 42, not just an amountof electrical power sufficient to operate the brake components directlyconnected to each individual power supply network 40, 42. For example,although first brake component 14 is not directly connected to secondpower supply network 42, enough electrical power to operate first brakecomponent 14 should be transmitted over second power supply network 42,so that in the event of a failure of first power supply network 40 (towhich first brake component 14 is attached), electrical power may betransmitted to first brake component 14 through second power supplynetwork 42 and second brake component 16 via first auxiliary powersupply link 44. In an alternative design, a low power mode may beemployed when the power supply capability is limited (i.e., when onepower supply network is failing or shorted). Although such a mode mayprovide degraded dynamic performance, such would prevent complete systemfailure.

In an alternative embodiment where two independent power supplies 13 areprovided, each power supply 13 may be capable of supplying half of therequired power to the brake system 10 via power supply networks 40, 42.If one of the power supply networks 40, 42 is short-circuited in onebrake unit, the power supplies 13 would be capable of supplying thecombined power from both power supplies 13 through the still functioningpower supply network 40, 42, thereby allowing the brake units to workwith full dynamic capability. The two power networks 40, 42 may bemechanically separated from each other (e.g., by being disposed ondifferent sides of the vehicle).

Thus, as discussed in the above example, suppose that an externalcatastrophic event occurs in the vicinity of first brake component 14which causes damage to first power supply network 40, thereby causingfirst power supply network 40 to be shorted and/or fail. Because secondpower supply network 42 is not directly electrically connected to firstbrake component 44, such an external catastrophic event likely would notcause damage to second power supply network 42, and second power supplynetwork 42 would still function. Since first brake component 14 would nolonger be receiving electrical power through first power supply network40, first auxiliary power supply link 44 would attempt to supplyelectrical power to first brake component 14 from second brake component16. Of course, due to the hypothetical external catastrophic event,first brake component 14 may be damaged or destroyed and not functionproperly, and/or first auxiliary power supply link 44 may be damaged.Thus, first brake component 14 may not be operational. However, thirdbrake component 18 and fifth brake component 22 are likely notdamaged—they are simply no longer receiving electrical power through thefailed first power supply network 40. As such, electrical power suppliedto third brake component 18 and fifth brake component 22 from fourthbrake component 20 and sixth brake component 24 through second auxiliarypower supply link 46 and third auxiliary power supply link 48respectively could be used to operate third brake component 18 and fifthbrake component 22.

Thus, system redundancy is provided, while at the same time isolation ofthe power supply networks 40, 42 from one another is maintained byproviding connection between brake components on different power supplynetworks 40, 42 by way of a buffer (i.e., auxiliary power supply links44, 46, 48). Thus, it is extremely unlikely that both power supplynetworks 40, 42 will fail. At the same time, if one of them does fail,operation of at least some of the brake components on the failed powersupply network can still be maintained.

In some cases, it may be desirable for two power supplies 13 to beprovided. When such is the case, one of power supplies 13 may beelectrically connected to first power supply network 40, while the otherof power supplies 13 may be electrically connected to second powersupply network 42. Alternatively, in order to maintain true redundancy(for example, if one of power supplies 13 fails), each of the two powersupplies 13 may be electrically connected to both power supply networks40, 42. In other cases, it may be desirable for a single power supply 13to be provided, which power supply 13 may be electrically connected toboth power supply networks 40, 42. Of course, in any case where powersupply or supplies 13 is or are connected to both power supply networks40, 42, it would be desirable to provide power supply or supplies 13with safeguard measures to ensure that shorting or other failure of onepower supply network 40, 42 does not short or otherwise cause a failureof the entire power supply or supplies 13.

In addition to providing electrical power to brake components 14, 16,18, 20, 22, 24, power supply or supplies 13 may provide electrical powerto various additional brake system components, such as antilock brakesystems (ABS) and electronic braking force distribution (EBV) systems,as well as other vehicle systems, such as vehicle suspension and dynamicstability systems. System 10 may also be employed to powernon-conventional systems, such as regenerative braking for hybridvehicles and integrated starter-generator systems (ISG).

System 10 also includes at least one human-machine interface (HMI) 50for allowing a driver to input various control commands. HMI 50 maycomprise, for example, a pedal, a switch, a joystick, a lever, a button,a knob, any other input device actuatable or manipulatable by a driver,or any combination of the above. Each HMI 50 includes two sensors 52,54, with each sensor 52, 54 being connected to one of electronic controlunits 12, 12′. The two electronic control units 12, 12′ are connectedvia a communications link 56 for cross-checking purposes as describedbelow.

The input signals produced by sensors 52, 54 of HMI 50 are used byelectronic control units 12, 12′ to control various functions of system10. For example, in the case of controlling application of the servicebrakes of a vehicle, HMI 50 typically comprises a brake pedal. Thisbrake pedal includes two sensors 52, 54 for detecting applicationthereof. Sensor 52 is connected to and provides input signals toelectronic control unit 12, while sensor 54 is connected to and providesinput signals to electronic control unit 12′. An exemplary method 58 forthe cross-checking of input signals received from HMI 50 and thecreation of control signals for controlling actuation of brakecomponents 14, 16, 18, 20, 22, 24 is shown in FIG. 4.

As shown in FIG. 4, at block 60 it is determined whether HMI 50, in thiscase a brake pedal, has been actuated (e.g., pressed). If the brakepedal has not been pressed, system 10 operates in service mode asindicated at block 62. If the brake pedal has been pressed, adetermination is made at block 64 as to whether the sensor signalreceived by one of the electronic control units 12 from the left sensor(for example, sensor 52) is valid. For example, a valid signal may fallwithin a certain voltage range (e.g., between 0.5V and 4.5V). Adetermination is similarly made at block 66 as to whether the sensorsignal received by the other one of the electronic control units 12′from the right sensor (for example, sensor 54) is valid.

If it is determined at blocks 64 or 66 that at least one of the sensorsignals is not valid, a brake system warning light is switched on (atblocks 68, 70) to inform the vehicle operator of an error condition. Ifit is determined at blocks 64 or 66 that both of the sensor signals arenot valid (indicated at block 72), thereby indicating a majormalfunction in brake system 10, electronic control units 12, 12′generate and transmit to brake components 14, 16, 18, 20, 22, 24 acommand signal to engage the parking brakes of the vehicle (indicated atblock 74) in order to prevent an out-of-control vehicle situation.

If it is determined at blocks 64 or 66 that at least one of the sensorsignals is valid, it is determined at block 76 whether the left sensorsignal differs from the right sensor signal by more than an acceptablevariance. For example, it may be determined whether the value of theleft sensor signal is 20% less or 20% greater than the value of theright sensor signal. A similar determination is made at block 78 as towhether the right sensor signal differs from the left sensor signal bymore than an acceptable variance.

If it is determined at blocks 76 and 78 that either the left sensorsignal differs from the right sensor signal by more than an acceptablevariance or that the right sensor signal differs from the left sensorsignal by more than an acceptable variance (indicated at block 80), abrake system warning light is switched on at block 82 to inform thevehicle operator of an error condition, and the higher of the leftsensor signal value and the right sensor signal value is used by theelectronic control units 12, 12′ to control the brake components 14, 16,18, 20, 22, 24 (indicated at block 84). If it is determined at blocks 76and 78 that neither the left sensor signal differs from the right sensorsignal by more than an acceptable variance nor that the right sensorsignal differs from the left sensor signal by more than an acceptablevariance (indicated at block 86), the preferred sensor signal value (inthis case the left sensor signal value) is used by the electroniccontrol units 12, 12′ to control the brake components 14, 16, 18, 20,22, 24 (indicated at block 88).

Other techniques for the cross-checking of input signals received fromHMI 50 and the creation of control signals for controlling actuation ofbrake components 14, 16, 18, 20, 22, 24 are also possible. For example,in the case where HMI 50 is a parking brake switch, lever, etc.,including two sensors, each sensor is connected to one of electroniccontrol units 12, 12′. If at least one of the sensors is “on” the systemgoes in to parking brake mode. If the data from the sensors areinconsistent, however, the electronic control units 12, 12′ willindicate this to the driver/vehicle system. Of course it will berecognized by those skilled in the art that other possibilities existfor cross-checking input signals in order to verify their accuracybefore acting upon them.

The present invention, therefore, provides an electrically controlledbraking system which is intended for use with wheeled vehicles, whichincorporates enhanced safety features, which employs system redundancyin case of partial system failure, which is relatively uncomplicated andless costly as compared to known systems, which is not prone to completesystem failure in the case of an external catastrophic event, and whichprovides for the checking of errors between input devices and thecontrol unit(s) which control actuation of the brakes.

Although the invention has been described with reference to a particulararrangement of parts, features and the like, these are not intended toexhaust all possible arrangements or features, and indeed many othermodifications and variations will be ascertainable to those of skill inthe art.

1. An electrically controlled braking system comprising: a first controlunit; a second control unit; wherein said first control unit and saidsecond control unit are in electrical communication via a communicationlink; a human machine-interface manipulatable by a vehicle operator,said human-machine interface comprising a first sensor and a secondsensor, the first sensor providing an input signal to said first controlunit, and the second sensor providing an input signal to said secondcontrol unit; and wherein said first control unit and said secondcontrol unit compare the input signal received from the first sensorwith the input signal received from the second sensor, and generatecontrol signals at least in part based upon the input signal receivedfrom the first sensor, the input signal received from the second sensor,and the comparison of the input signal received from the first sensorwith the input signal received from the second sensor.
 2. The system ofclaim 1 wherein said first control unit and said second control unitfurther determine whether the input signal received from the firstsensor and the input signal received from the second sensor are valid.3. The system of claim 2 wherein the determination as to whether theinput signal received from the first sensor and the input signalreceived from the second sensor are valid is based at least in part upona determination as to whether the input signal received from the firstsensor and the input signal received from the second sensor have valuesfalling within an expected range.
 4. The system of claim 2 furthercomprising an error condition indicator, and wherein the error conditionindicator is activated if at least one of the input signal received fromthe first sensor and the input signal received from the second sensor isinvalid.
 5. The system of claim 4 wherein said first control unit andsaid second control unit generate control signals indicative of a demandfor parking brake application if both of the input signal received fromthe first sensor and the input signal received from the second sensorare invalid.
 6. The system of claim 1 wherein the comparison of theinput signal received from the first sensor with the input signalreceived from the second sensor is based at least in part upon adetermination of whether a value of the input signal received from thefirst sensor differs from a value of the input signal received from thesecond sensor by more than an acceptable variance.
 7. The system ofclaim 6 wherein the comparison of the input signal received from thefirst sensor with the input signal received from the second sensor isfurther based at least in part upon a determination of whether a valueof the input signal received from the second sensor differs from a valueof the input signal received from the first sensor by more than anacceptable variance.
 8. The system of claim 1 wherein said humanmachine-interface comprises at least one of a pedal, a switch, ajoystick, a lever, a button and a knob.
 9. The system of claim 1 furthercomprising: a first brake component responsive to the control signalsgenerated by said first control unit and said second control unit; asecond brake component responsive to the control signals generated bysaid first control unit and said second control unit; a first controlnetwork electrically connecting said first control unit and said firstbrake component, said first control network adapted to transmit thecontrol signals from said first control unit to said first brakecomponent; and a second control network electrically connecting saidsecond control unit and said second brake component, said second controlnetwork adapted to transmit the control signals from said second controlunit to said second brake component.
 10. The system of claim 9 furthercomprising an auxiliary control link electrically connecting said firstbrake component and said second brake component, said auxiliary controllink adapted to transmit the control signals between said first brakecomponent and said second brake component when a failure occurs in oneof said first control network or said second control network.
 11. Thesystem of claim 1 further comprising: at least one power supply, said atleast one power supply supplying electrical power; a first brakecomponent responsive to the control signals generated by said firstcontrol unit and said second control unit and at least partiallyoperated by electrical power; a second brake component responsive to thecontrol signals generated by said first control unit and said secondcontrol unit and at least partially operated by electrical power; afirst power supply network electrically connecting said at least onepower supply and said first brake component, said first power supplynetwork adapted to transmit the electrical power from said at least onepower supply to said first brake component; and a second power supplynetwork electrically connecting said at least one power supply and saidsecond brake component, said second power supply network adapted totransmit the electrical power from said at least one power supply tosaid second brake component.
 12. The system of claim 11 furthercomprising an auxiliary power supply link activatable to electricallyconnect said first brake component and said second brake component whena failure occurs in one of said first power supply network or saidsecond power supply network, said auxiliary power supply link adapted totransmit the electrical power between said first brake component andsaid second brake component when the failure occurs.
 13. An electricallycontrolled braking system comprising: at least one control unit, said atleast one control unit generating control signals; at least one powersupply, said at least one power supply supplying electrical power; afirst brake component responsive to the control signals generated bysaid at least one control unit and at least partially operated byelectrical power; a second brake component responsive to the controlsignals generated by said at least one control unit and at leastpartially operated by electrical power; a first control networkelectrically connecting said at least one control unit and said firstbrake component, said first control network adapted to transmit thecontrol signals from said at least one control unit to said first brakecomponent; a second control network electrically connecting said atleast one control unit and said second brake component, said secondcontrol network adapted to transmit the control signals from said atleast one control unit to said second brake component; an auxiliarycontrol link electrically connecting said first brake component and saidsecond brake component, said auxiliary control link adapted to transmitthe control signals between said first brake component and said secondbrake component when a failure occurs in one of said first controlnetwork or said second control network; a first power supply networkelectrically connecting said at least one power supply and said firstbrake component, said first power supply network adapted to transmit theelectrical power from said at least one power supply to said first brakecomponent; a second power supply network electrically connecting said atleast one power supply and said second brake component, said secondpower supply network adapted to transmit the electrical power from saidat least one power supply to said second brake component; and anauxiliary power supply link activatable to electrically connect saidfirst brake component and said second brake component when a failureoccurs in one of said first power supply network or said second powersupply network, said auxiliary power supply link adapted to transmit theelectrical power between said first brake component and said secondbrake component when the failure occurs.
 14. The system of claim 13:wherein said at least one control unit comprises a first control unitand a second control unit and further comprising: wherein said firstcontrol unit and said second control unit are in electricalcommunication via a communication link; further comprising a humanmachine-interface manipulatable by a vehicle operator, saidhuman-machine interface comprising a first sensor and a second sensor,the first sensor providing an input signal to said first control unit,and the second sensor providing an input signal to said second controlunit; and wherein said first control unit and said second control unitcompare the input signal received from the first sensor with the inputsignal received from the second sensor, and generate control signals atleast in part based upon the input signal received from the firstsensor, the input signal received from the second sensor, and thecomparison of the input signal received from the first sensor with theinput signal received from the second sensor.
 15. The system of claim 14wherein said first control unit and said second control unit furtherdetermine whether the input signal received from the first sensor andthe input signal received from the second sensor are valid.
 16. Thesystem of claim 16 wherein the determination as to whether the inputsignal received from the first sensor and the input signal received fromthe second sensor are valid is based at least in part upon adetermination as to whether the input signal received from the firstsensor and the input signal received from the second sensor have valuesfalling within an expected range.
 17. The system of claim 15 furthercomprising an error condition indicator, and wherein the error conditionindicator is activated if at least one of the input signal received fromthe first sensor and the input signal received from the second sensor isinvalid.
 18. The system of claim 17 wherein said first control unit andsaid second control unit generate control signals indicative of a demandfor parking brake application if both of the input signal received fromthe first sensor and the input signal received from the second sensorare invalid.
 19. The system of claim 14 wherein the comparison of theinput signal received from the first sensor with the input signalreceived from the second sensor is based at least in part upon adetermination of whether a value of the input signal received from thefirst sensor differs from a value of the input signal received from thesecond sensor by more than an acceptable variance.
 20. The system ofclaim 19 wherein the comparison of the input signal received from thefirst sensor with the input signal received from the second sensor isfurther based at least in part upon a determination of whether a valueof the input signal received from the second sensor differs from a valueof the input signal received from the first sensor by more than anacceptable variance.
 21. The system of claim 14 wherein said humanmachine-interface comprises at least one of a pedal, a switch, ajoystick, a lever, a button and a knob.
 22. A method of controlling abraking system comprising the steps of: providing a first control unitand a second control unit in electrical communication with one anothervia a communication link; manipulating a human machine-interface havinga first sensor and a second sensor; providing an input signal from thefirst sensor to the first control unit; providing an input signal fromthe second sensor to the second control unit; comparing the input signalreceived from the first sensor with the input signal received from thesecond sensor; and generating control signals at least in part basedupon the input signal received from the first sensor, the input signalreceived from the second sensor, and the comparison of the input signalreceived from the first sensor with the input signal received from thesecond sensor.
 23. The method of claim 22 further comprising the step ofdetermining whether the input signal received from the first sensor andthe input signal received from the second sensor are valid.
 24. Themethod of claim 23 wherein said step of determining whether the inputsignal received from the first sensor and the input signal received fromthe second sensor are valid is based at least in part upon adetermination as to whether the input signal received from the firstsensor and the input signal received from the second sensor have valuesfalling within an expected range.
 25. The method of claim 23 furthercomprising the step of activating an error condition indicator if atleast one of the input signal received from the first sensor and theinput signal received from the second sensor is invalid.
 26. The methodof claim 25 further comprising the step of generating control signalsindicative of a demand for parking brake application if both of theinput signal received from the first sensor and the input signalreceived from the second sensor are invalid.
 27. The method of claim 22wherein said step of comparing the input signal received from the firstsensor with the input signal received from the second sensor is based atleast in part upon a determination of whether a value of the inputsignal received from the first sensor differs from a value of the inputsignal received from the second sensor by more than an acceptablevariance.
 28. The method of claim 27 wherein said step of comparing theinput signal received from the first sensor with the input signalreceived from the second sensor is further based at least in part upon adetermination of whether a value of the input signal received from thesecond sensor differs from a value of the input signal received from thefirst sensor by more than an acceptable variance.
 29. The method ofclaim 22 wherein the human machine-interface comprises at least one of apedal, a switch, a joystick, a lever, a button and a knob.
 30. Themethod of claim 22 further comprising the steps of: providing a firstbrake component responsive to the control signals generated by the firstcontrol unit and the second control unit; providing a second brakecomponent responsive to the control signals generated by the firstcontrol unit and the second control unit; electrically connecting thefirst control unit and the first brake component via a first controlnetwork, the first control network adapted to transmit the controlsignals from the first control unit to the first brake component; andelectrically connecting the second control unit and the second brakecomponent via a second control network, the second control networkadapted to transmit the control signals from the second control unit tothe second brake component.
 31. The method of claim 30 furthercomprising the step of electrically connecting the first brake componentand the second brake component via an auxiliary control link, theauxiliary control link adapted to transmit the control signals betweenthe first brake component and the second brake component when a failureoccurs in one of the first control network or the second controlnetwork.
 32. The method of claim 22 further comprising the steps of:supplying electrical power with at least one power supply; providing afirst brake component responsive to the control signals generated by thefirst control unit and the second control unit and at least partiallyoperated by electrical power; providing a second brake componentresponsive to the control signals generated by the first control unitand the second control unit and at least partially operated byelectrical power; electrically connecting the at least one power supplyand the first brake component via a first power supply network, thefirst power supply network adapted to transmit the electrical power fromthe at least one power supply to the first brake component; andelectrically connecting the at least one power supply and the secondbrake component via a second power supply network, the second powersupply network adapted to transmit the electrical power from the atleast one power supply to the second brake component.
 33. The method ofclaim 32 further comprising the step of activating an auxiliary powersupply link to electrically connect the first brake component and thesecond brake component when a failure occurs in one of the first powersupply network or the second power supply network, the auxiliary powersupply link adapted to transmit the electrical power between the firstbrake component and the second brake component when the failure occurs.